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ABSTRACT 


This thesis develops an Operator’s Model that mimics the real-world behavior of coal 
transport in the Port of Pittsburgh and allows for systematic investigation of “what if” 
disruption scenarios. We model the multi-modal flow of coal using a network of nodes 
and arcs representing river transport, with support from a surrounding system of rail lines 
and roads. Each mode of shipment has finite capacities with varying costs. Our model 
routes flows in order to satisfy contracted supplies and demands at minimum 
transportation cost. We use 2009 coal shipment data provided by the United States Army 
Corps of Engineers to drive delivery patterns. We focus our attention on the 
Monongahela River, which carries a significant amount of coal through our system. We 
employ Defender-Attacker-Defender techniques to assess critical infrastructure in the 
context of an intelligent adversary, such as a terrorist, who seeks to damage the system so 
as to maximally increase its operating cost. This allows us to assess the relative 
importance of critical system components in order to help the United Stated Coast Guard 


identify where to focus their attention. 
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EXECUTIVE SUMMARY 


The United States (U.S.) economy is dependent upon coal to produce low cost energy and 
to manufacture steel. The Three Rivers region of Pittsburgh, Pennsylvania—consisting of 
the Ohio River, the Allegheny River, and the Monongahela River—sits on one of the 
richest coal reserves in the U.S.. The Port of Pittsburgh stretches over more than 
300 miles of river and supports an extensive coal mining and coal consuming industry. 
Nearly $9 billion of commerce flows through this river system annually, making it the 
second largest inland port in the U.S. and a valuable target for terrorist attack. The United 
States Coast Guard (USCG) is responsible for safe, uninterrupted transport (and 
coordinated security) along these inland waterways, and this port is of particular 


importance to this mission. 


Coal is delivered from mines to plants primarily via the river, with support from a 
surrounding system of rail lines and roads. Transporting coal by barge on river is the 
most economical and efficient means of delivery. Rail offers a more costly alternative, 
and trucks on roads are the most expensive method of transportation. Loading and 
offloading coal are also costly processes. But these costs are small relative to the huge 
financial loses and catastrophic facility shutdowns that could occur if coal was unable to 
move from supplier to consumer for an extended period of time. 

The primary contribution of this thesis is the development of an Operator’s Model 
that mimics the behavior of coal transport in the Port of Pittsburgh and allows for 
systematic investigation of “what if’ scenarios. We model the multi-modal flow of coal 
using a network of nodes and arcs. Each mode of shipment has finite capacities with 
varying costs. Our model routes flows in order to satisfy contracted supplies and demands 
at minimum transportation cost. We use real-world 2009 data provided by the United 


States Army Corps of Engineers to drive delivery patterns. 


We employ Defender-Attacker-Defender techniques to assess _ critical 
infrastructure in the context of an intelligent adversary, such as a terrorist, who seeks to 
damage the system so as to maximally increase its operating cost. Key assets in our 


system include dams, which segment the rivers into pools and maintain water levels that 


XV 


enable navigability; locks, which allow for transit between these pools; bridges, which 
connect land masses by crossing over rivers; and intermodal transfer equipment, which 


loads and offloads cargo and facilitates transfer between rivers, roads, and rails. 


We focus our attention on the Monongahela River, which carries a significant 
amount of coal through our system. Our model first analyzes normal operating 
conditions, routing coal by barge, and then considers the effects of disruptions to the river 
system. We identify interdictions that result in worst-case disruptions, where “worst- 
case” means the highest total cost even after the system has rebalanced flows. The model 
illustrates rerouting behaviors and impact costs associated with operating in this damaged 
system. This helps us assess the relative importance of critical system components to help 


the USCG to identify where to focus its attention. 


We observe that a single attack on the pool connecting the Monongahela River to 
the rest of the Pittsburgh Port incurs significant cost increases. Attacking the dam 
supporting this pool renders the pool useless. Subsequent “next best” attacks also target 
other dams and eventually some locks. Each disruption to the river unavoidably increases 


traffic on other modes of transport, increasing overall cost. 


We consider two alternative scenarios. First, we analyze a situation in which we 
assume that the USCG can perfectly protect the dams from attack. Defending dams 
causes the attacker to target locks instead, thereby decreasing the worst-case cost of an 
attack on an unprotected system. The second scenario is a situation in which the USCG 
can perfectly protect both dams and locks. With the water protected, the attacker can only 
target land-based terminals, rail segments and road segments. However, an attacker still 
has the ability to isolate a major coal supplier from the network by interdicting river, rail, 
and road intermodal transfer arcs connecting the supplier to the rest of the world. Because 
our model highly penalizes such infeasibilities, the cost skyrockets, as the coal supplier is 


unable to move cargo onto the system. 


Our model can be applied to others ports within the Inland Waterway System, 
however doing so will require significant effort to develop the appropriate input data and 


exercise various what-if scenarios of interest. 
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I. INTRODUCTION 


The United States relies on low-cost transportation of goods. Bulk shipment of 
commodities is vital to the U.S. economy and its national security. A complicated 
network of rivers, rail lines, and roads enable the surface movement of large quantities of 
raw materials across the country. Despite the ubiquity of air transport, most physical 
goods move by ground, as their value per unit weight does not justify air delivery 
(Research and Innovative Technology Administration Bureau of Transportation Statistics 
2002). The primary commodity transported by river and rail in the U.S. is coal. Coal is an 
industrial and residential necessity, providing heat, electricity, and a means to produce 
steel. A disruption to this network could inflict costly consequences, as frustrated 
shipments attempt to find new delivery routes. 

The Three Rivers region of Pittsburgh, Pennsylvania sits on one of the richest coal 
reserves in the U.S.. The Monongahela and Allegheny Rivers converge to form the Ohio 
River at the Point of Pittsburgh. These three rivers stretch more than 300 miles and define 
the area known as the Port of Pittsburgh. The United States Army Corps of Engineers 
(USACE) ranks the Port of Pittsburgh as the second busiest inland port in the United 
States (USACE 2012). The Port of Pittsburgh Commission (PPC) provides extensive 
information regarding locks, dams, and river characteristics (PPC 2012a). The Ohio River 
connects the Port of Pittsburgh to the rest of the Inland Waterways System, a system of 
more than 25,000 miles of navigable waters in the Eastern United States (Figure 1). Coal 


and other commodities are transported into and out of the region via barge on this river. 


334 Milage Between Cities 
3 Number of Locks 





Figure 1. | The Inland Waterway System. Source: PPC 2012b. 


The Port of Pittsburgh is regulated by a series of locks and dams and provides the 
primary means of coal delivery to power companies and steel producers in the area. 
Labor disputes, natural disasters, terrorist attacks, and even anticipated maintenance on 
the existing infrastructure can disrupt the function of this system. A catastrophic 
disruption to the coal-delivery supply chain could cause national consequences, including 
a rise in utility costs and steel prices. The Port of Pittsburgh Commission reports that 
“inland waterway transportation is generally the least-costly transportation mode. 


Average cost ranges between $0.005 and $0.01 per ton-mile of cargo moved. This 


Z 


compares to nearly $0.05 for rail and $0.10 for truck” (PPC 2012b). Therefore, 
stakeholders are intent on providing resilient transportation along these waterways to 
maintain low costs. 

The enormous capacity of the river system and its low operating costs make it the 
primary means of bulk commodity shipment through the Port of Pittsburgh. Although 
there are multiple modes of transport for coal in this region, the large demand volumes 
make it cost prohibitive to supply adequate quantities in the long term by means other 
than river. Figure 2 shows cargo capacity of different modes of transport; clearly barges 


can Carry much more cargo. 


Cargo Capacity Comparison 


ONE JUMBO 4 LARGE 
HOPPER CAR » # «@ = semtrucks QO ay 
(100 tons) (25tons each) i) ayy 


ONE BARGE (1,750 TONS) = 16 JUMBO HOPPER CARS 


* Moving cargo by waterway transportation is 40% more efficient than railroads. 





Figure 2. | Comparison of cargo capacity of rail car, truck, and barge. Source: Port of 
Pittsburgh Commission, 2012c. 
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In practice, the most cost effective means for moving coal on the river is via 


9 


multiple barges pushed by a single towboat. Figure 3 displays a “12-barge tow.’ 





Figure 3. | The most economical way to move coal is by barge. Source: USACE 2012. 


The interdiction of coal delivery along these primary river-shipment routes would 
have dire implications. For purposes of this thesis, interdiction is the interruption of 
commodity movement through our system. Limited capacity and availability of rail cars 
calls into question the viability of trains. Additionally, transporting large volumes of coal 
via truck could place an extreme burden on the road network, causing immediate 
bottlenecks. Many coal consumers maintain some level of reserves on hand to mitigate 
fluctuations in delivery or consumption rates and for emergency situations. However, 
these reserves are finite, and steel manufacturers in the Pittsburgh region cannot run out 
of coal or they risk huge financial loses and catastrophic facility shutdowns. 

The vulnerability of aging infrastructure along with economic significance makes 
Pittsburgh a real target. Protecting the city and its infrastructure is challenging—there are 
three modes of transportation and so many routes into the city that protecting them all is 
impossible. Potential attacks include blocking traffic through locks, destroying dams, 
dropping bridges that cross the rivers, or even attacking the commodity-carrying vessels. 
This infrastructure is not heavily guarded and is easily accessible. Protection of locks and 
dams from the shore is the responsibility of local municipalities, and defense from the 
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water resides with the United States Coast Guard (USCG). Bridges and slow-moving 
vessels (barges travel at an average speed of approximately 4 miles per hour) are very 
accessible, making them soft targets. Repairs subsequent to an attack on this aging 
infrastructure are estimated to require weeks to months, depending on the extent of the 
damage and the components damaged. 

The USCG is tasked with ensuring economic stability and safe navigation of these 
waterways. One of the missions of the USCG is the protection of Ports, Waterways, and 
Coastal Security (PWCS). 

PWCS is the protection of the U.S. Maritime Domain and the U.S. Marine 

Transportation System (MTS) and those who live, work or recreate near 

them; the prevention and disruption of terrorist attacks, sabotage, 

espionage, or subversive acts; and response to and recovery from those 

that do occur. Conducting PWCS deters terrorists from using or exploiting 

the MTS as a means for attacks on U.S. territory, population centers, 

vessels, critical infrastructure, and key resources. PWCS includes the 

employment of awareness activities; counterterrorism, antiterrorism, 
preparedness and response operations; and the establishment and oversight 

of a maritime security regime. PWCS also includes the national defense 

role of protecting military out-load operations. (USCG, 2011) 

In Pittsburgh, the USCG District 8 Command has jurisdiction for these 328 miles 
of river, which connect Pennsylvania, Ohio, and West Virginia. Complicating the USCG 
mission are the many bridges, projected reductions in USCG force size, and increased 
concern about terrorist attack in the post-9/11 era. Traditional security is only part of the 
solution. This infrastructure faces not only deliberate threats from terrorists and 
saboteurs, but it is also at risk to disruptions from engineering failures, accidents, and 
natural disasters. As demand for coal increases, rising shipping traffic and strains on 
infrastructure will result. The USCG needs to be able to identify worst-case disruptions in 
advance of their occurrence and no matter their cause. 

The solution to maintaining economic and industrial stability in the event of an 
attack is the development of a resilient system. For purposes of this thesis, we define 
resilience as the ability of a system to maintain its function in the presence of internal or 


external disruptions; this definition is consistent with that of the Homeland Security 


Advisory Council (HSAC 2006) and the Homeland Security Council (HSC 2007). Ways 
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to achieve such resiliency include increased capacity of infrastructure, improved 
protection of critical components, or cost-effective re-routing plans to optimally ship 
commodities in the event of disruption. The U.S. National Strategy for Homeland 
Security says, “we must now focus on the resilience of the system as a whole—an 
approach that centers on investments that make the system better able to absorb the 
impact of an event without losing the capacity to function” (HSC 2007). 

The goal of this thesis is to assess the resiliency of the system of rivers, rails, and 
roads that move coal from mines to customers in the Pittsburgh area. We use Defender- 
Attacker-Defender (DAD) techniques to identify which components to defend and 
provide minimum-cost solutions to routing in the event of failures in the system. By 
applying these methods to the Port of Pittsburgh, we assess the relative importance of 
critical system components in order to help the USCG identify where to focus its 


attention. 


I. LITERATURE REVIEW 


This thesis contributes to the body of existing works in the area of optimization, 
the defense of critical infrastructure, and the transportation of commodities. While the 


following related works are not exhaustive, they contain underpinnings vital to this work. 
A. CRITICAL INFRASTRUCTURE AND RISK 


The National Infrastructure Protection Plan (NIPP) identifies critical 
infrastructure as, “systems and assets, whether physical or virtual, so vital to the United 
States that the incapacity or destruction of such systems and assets would have a 
debilitating impact on security, the national economy, national public health or safety, or 
any combination of those matters” (DHS 2009). 

Risks to infrastructure threaten lives, economic stability, and national security. As 
defined in the DHS Risk Lexicon (DHS 2010), risk is “potential for an unwanted 
outcome resulting from an incident, event, or occurrence, as determined by its likelihood 
and the associated consequences.” (In general, we follow definitions put forth in this 
Lexicon.) It is not enough to merely protect against initial attacks on critical 
infrastructure and key resources (CI/KR). As described in the NIPP, we must be prepared 
to (1) deter attacks, (2) endure their impact, and (3) regain normal operation as soon as 
possible (DHS 2009). The NIPP aims to deter, foil, or decrease the effects of purposeful 
attacks and to increase readiness, responsiveness, and resiliency of CI/KR in the event of 
an attack, natural disaster, or other emergency (DHS 2009). The NIPP promotes 
cooperation of private and government agencies in the development of prevention, 
response, mitigation, and recovery efforts. Providing security everywhere at all times is 
impossible with limited personnel, and building infrastructure that is completely resistant 
to attack is difficult with limited financial resources. This intentional defense guidance 
outlined in the NIPP fosters organizational cooperation to overcome inherent limits and 
achieve necessary readiness. 

The Marine Transportation Security Act (MTSA) of 2002 mandates that vessels 
and ports conduct vulnerability assessments as part of local Area Maritime Security Plans 


(Maritime Transportation Security Act of 2002). The USCG Captain of the Port is the 
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Federal Maritime Security Coordinator charged with oversight of the local Area Maritime 
Security Committee, who develops and implements those plans. 

Guided by the NIPP, DHS evaluates risk as a function of threats, vulnerabilities, 
and consequences and then applies this definition of risk to deliberate and non-deliberate 
events indiscriminately. The DHS has adopted Probabilistic Risk Assessment (PRA) to 
estimate risk and prepare for potential threats from both natural causes and malicious 
enemies (see Bedford and Cooke. 2001. for an introduction to PRA). In this context, 
threat is the probability of attack, vulnerability is the conditional probability of success 
given an attack, and consequence is the result of successful attack, measured either in 
lives lost or dollars damage (DHS 2009). Examples of this PRA application in use are the 
Risk Analysis and Management for Critical Asset Protection (RAMCAP) (ASME 2011), 
the Terrorism Risk Assessment and Management (TRAM) toolkit (NRC 2010), and the 
Maritime Security Risk Analysis Model (MSRAM), employed by the USCG (GAO 
2010). Additionally, the DHS conducts data calls and information sharing to assess 
CI/KR and relies on the aggregate knowledge of its personnel to accurately assess 
vulnerability. By quantifying risk at each key component of a system, the goal of DHS is 
to allocate defense resources judiciously in order to mitigate risk. One example of these 
data-sharing efforts is the Constellation/Automated Critical Asset Management System 
(C/ACAMS, see DHS 2012 for details). This web-based tool allows users to access and 
share CI/KR information, assess vulnerabilities, and develop reaction plans. These types 
of information management and internal assessments, combined with probabilistic 
approach to attacks, drive DHS risk efforts and defense planning. 

As documented by the National Research Council (NRC 2008, 2010) there are 
problems with these methods of evaluating risk. First, there is not enough historical data 
to assess probability of future terrorist attack, and it is questionable in this context 
whether past events are representative of future ones. Relying on subjective assessment 
from subject matter experts to assess probabilities has inherent biases and simply cannot 
be validated against ground truth. Second, deliberate attacks from an adversary are 
distinctly different from non-deliberate events, such as accidents, failures, or natural 


disasters, and should be handled separately. Acts of nature, for example, may be handled 


with a probabilistic approach, as these acts happen as random occurrences based on 
seasonal or climatic conditions, or on engineering failures or operational errors, and 
historical data is readily available for characterizing these probabilities. Even human 
errors or mishaps can be characterized by probabilities. But, once an intelligent adversary 
enters the scenario, the rules change (see Engel 2011 for a detailed discussion). This 
adversary has harmful motives and accomplishes his intent through thoughtful planning 
and observation of CI/KR. The actions of this attacker are not random, but deliberate. To 
assume that an adversary behaves according to known probabilities would be to neglect 
the autonomous nature of the enemy at our own peril. 

Brown and Cox (2011) raise additional issues with predicting risk based on 
subjective probability estimates of possible enemy actions. Specifically, they contend that 
dismissing the differences between scenarios involving intelligent adversaries and 
random threats can have significant consequences. They argue that threat—vulnerability— 
consequence (TVC) formula “Risk = (Probability of attack) x (Probability that attack 
succeeds, given that it occurs) x (Consequence of a successful attack)” is a poor 
estimator of risk, amounting at best to a guess of potential risk. Additionally, they point 
out that PRA does not provide decision makers insight on where to invest resources to 
mitigate this risk and note that probabilities regarding enemy action may be impossible to 
correctly predict. Instead, they recommend focusing on enhanced infrastructure and 
defense efforts that improve the system’s ability to rebound from an attack and quickly 
return to satisfactory operating conditions. Engel (2011) also summarizes some of the 
flaws of the threat-vulnerability-consequences approach to risk in the context of system 
interdiction models. 

Brown and Cox (2011) suggest game theory as a superior approach to PRA when 
evaluating risk in a system. Game theory considers the intelligent decisions of both the 
attacker and the defender, allowing each to freely choose when, where, and how he acts, 
but admitting that defender acts will be visible to the attacker. This more closely 
represents an actual defender preparing for possible threats, an attacker seeking to inflict 
maximum harm, and a defender (or operator) attempting to manage his system in a 


damaged, degraded condition. Viewing the interaction between friendly and enemy 


combatants in this manner eliminates the requirement to subjectively identify 
consequences, vulnerabilities, and threats of a system and focuses attention on the CI/KR 
that, if attacked, would result in maximum frustration of the system. 

The 2010 NRC review of DHS approaches to risk analysis concludes: 

Conclusion: These network disruption and systems resilience models 

(which supplant and move away from current limitations of TVC analyses 

for CI/KR) are ideal for longer-term investment decisions and capabilities 

planning to enhance infrastructure systems’ resiliency, beyond just site- 

based protection. Such models have been used in other private sector and 


military applications to assist decision-makers in improving continuity of 
operations. 


Recommendation: DHS should continue to enhance CI/KR data collection 
efforts and processes and should rapidly begin developing and using 
emerging state-of-the art network and systems disruption resiliency 
models to understand and characterize vulnerability and consequences of 
infrastructure disruptions. (NRC 2010, page 69) 


We follow this guidance to evaluate CI/KR resiliency on the Port of Pittsburgh. 

There has been considerable interest in the use of game theory for security 
problems. Tambe et al. (2011) use game theory to consider security problems. They 
formulate a Stackelberg game for ports and inland waterway security in order to assist 
USCG efforts in combating terrorism. The Port Resilience Operational / Tactical 
Enforcement to Combat Terrorism (PROTECT) model is an example of the application 
of game theory techniques to defense efforts (Shieh et al., 2012). Additional applications 
of this technique include Assistant for Randomized Monitoring Over Routes (ARMOR) 
in the Los Angeles International Airport, Intelligent Randomization in Scheduling (IRIS) 
in the U.S. Federal Air Marshal Service, and Game Theoretic Unpredictable and 
Randomly Deployed Security (GUARDS) in the Transportation Security Agency 
(TEAMCORE 2011). 


B. SYSTEM INTERDICTION MODELS 


Another use of game theory has been to consider system interdiction problems. 
Wood (1993) introduces a deterministic interdiction scenario. He details the usefulness of 


this technique in the context of “reducing the flow of drugs and related chemicals through 
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river and road networks in South America” (Wood 1993). His work considers two 
opponents, with a smuggler trying to maximize the amount of drugs transported through a 
network and an interdictor trying to minimize routes to achieve this objective. Wood uses 
a small 14-node, 25-arc sample problem to portray the interactions of the smuggler and 
interdictor on a capacitated network. He also considers the use of multiple commodities 
and other variations and extensions of this problem. Our problem is similar, with role 
reversals, where we are attempting to move coal across a network and the interdictor is an 
intelligent adversary, seeking to cut off our ability to traverse the system. 

Brown et al. (2005, 2006) introduce Defender-Attacker-Defender (DAD) models 
to represent the interaction between an enemy (attacker) and an operator (defender). This 
three-move game begins with the defender analyzing his system and choosing a defense 
plan to minimize the effects of any potential attack. He may increase capacity, improve 
security, or reinforce vital system components. The next move belongs to the attacker, 
who evaluates the system, having full knowledge of the defender’s defense strategy and 
then attacks to inflict maximum damage. Finally, the operator attempts to manage the 
damaged system to minimize the impact of the attack. Wood (2011) provides a summary 
of network interdiction problems and the techniques for solving them. 

Pidgeon (2008) develops a simulation model to estimate the costs associated with 
disruptions to the Marine Transportation System (MTS), specifically incidents at the 
major west coast ports of the U.S.. He explains the significance of western ports to the 
domestic economy, as these ports handle the majority of imported containerized cargo for 
the U.S.. He considers various scenarios, ranging from striking union workers to 
earthquakes in California that could cause delays in the handling of containerized cargo. 
Pidgeon considers the ability of government agencies to advise redirection of commercial 
vessels, assuming industry leaders would make wise, lowest-cost decisions in rerouting 
ships to alternate available ports. Pidgeon’s model uses queues to represent ships 
awaiting offload, and displays growing penalty costs related to infrastructure 
shortcomings. The model analyzes infrastructure capacity limitations and identifies choke 
points where government and/or commercial agencies may invest to mitigate penalty 


costs associated with delayed shipments. 
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Bencomo (2009) analyzes the impact of various disruptions on the containerized 
transportation system into and out of North America. He develops an Attacker-Defender 
(AD) model, looking first at the optimal routes of shipment, then considers the effects of 
an intelligent adversary, workforce strikes, and natural disasters. This model seeks the 
most efficient means to transport goods from source to destination by taking advantage of 
various modes of transport. He considers road, rail, and water travel and develops a 
model to appropriately choose the best mode of travel at different stages of delivery. The 
model seeks the most cost-efficient means to satisfy supplies and demands. He suggests 
that future areas of study investigate more accurate representations of transport systems. 
Additionally, he advocates for more involvement from key stakeholders, to better 
understand the true ramifications of disruptions on the system. 

De la Cruz (2011) evaluates the ability of the MTS to import various goods into 
Hawaii, via refrigerated and non-refrigerated containers. He observes that the large 
majority of consumer goods come from outside the island. Due to the limited storage 
capacity of the island, the system is fragile and cannot easily handle disruptions, making 
it susceptible to attack. Using Attacker-Defender modeling, he identifies system 
components (e.g., piers, cranes, and terminals) that are vital to maintaining the 
uninterrupted flow of containerized shipments. His work assesses how well the Hawaiian 
MTS handles worst-case disruptions and the effect of those disruptions in terms of 
delivery shortages. By identifying key components of the system and analyzing the 
system’s resiliency to attacks, de la Cruz affords government agencies and other 
commercial stakeholders insight into greatest areas of need for improved equipment, 
increased capacity, and better policies. 

Babick (2009) challenges conventional risk management tools used by the 
Department of Homeland Security and compares current methods, such as RAMCAP, 
with AD and DAD algorithms. Babick demonstrates that DAD is superior to the risk- 
based techniques, consistently providing answers that are as good, or better. Additionally, 
he shows that results from the DAD model provide insight into necessary improvements 
to infrastructure, an advantage over the risk management methods. Focusing on the 


western U.S. rail network, Babick explains that DAD and AD produce optimal routes 
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following an attack on the system. This exposes the susceptibility of certain arcs and 
nodes throughout the network and, as costs to redirect traffic rise, encourages further 
investigation of these critical pieces of infrastructure. This type of system transparency is 
not available in traditional PRA risk management methods. 

Alderson et al. (2011) demonstrate the use of a Defender-Attacker-Defender 
(DAD) model in the context of a transportation system consisting of roads and bridges, 
and they provide a formal algorithm for solving the DAD tri-level optimization problem. 

Engel (2011) compares risk-based assessment and game-theoretic techniques as 
viable USCG approaches to defending critical infrastructure against attack. The medium 
for this analytic comparison is the evaluation of the flow of coal along a particularly 
small portion of the Pittsburgh region. He develops an Attacker-Defender model, 
consisting of roads, railways, and rivers, to determine critical vulnerabilities to the 
shipment of a single commodity (coal) from mines to power plants and _ steel 
manufacturers. Using notional data, his analysis provides proof-of-concept about the 


potential insights from a more rigorous study. 
C. CONTRIBUTIONS OF THIS THESIS 


The primary contribution of this thesis is the development of an Operator’s Model 
that mimics the real-world behavior of coal transport in the Port of Pittsburgh and allows 
for systematic investigation of “what if’ scenarios. 

Building on the work done by Engel (2011), we expand the area of operation to 
include more mines and factories. We consider the movement of multiple types of coal, 
as contracted between individual suppliers and consumers. These changes add 
complexity, yet provide more realistic traffic flow, and a better understanding of the 
system in the Pittsburgh area. 

We include multiple commodities, in the spirit of de la Cruz (2010), and multiple 
modes of transport as in Bencomo (2009). This produces a model that is closer to reality 
and provides further understanding of the interaction of these commodities on a 


complicated network. 
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HI. RIVER TRANSPORT 


The starting point of any analysis of critical infrastructure is to understand its 
basic function and operations, so as to be able to assess the consequences of disruption to 
that function. River transportation is a primary means of moving large quantities of bulk 
commodities. Although rail lines and roads are important shipment modes, rivers garner 
special attention in this thesis. Because coal accounts for 76% of river traffic by volume 
through the Port of Pittsburgh (PPC 2010), we provide a more detailed description of 
river shipment 

The Monongahela and Allegheny Rivers converge to form the Ohio River at the 
Point of Pittsburgh. Figure 4 depicts our area of interest (AOI) around Pittsburgh, 
including the many locks and dams. These three rivers stretch more than 300 miles and 
provide both public recreation and enormous commercial shipping capacity. These rivers 
also flow through the most extensive coal bed in the Appalachian Basin (Puglio 1983). 
Exploitation of coal in this region began as early as 1751 (White 1898). Companies in the 
area are faithful consumers of coal and many rely solely on this local commodity for 
producing steel and generating electricity. 

The characteristics of coal vary regionally, and coal is rated on its burn quality. 
“Coal is classified into four main types, or ranks (anthracite, bituminous, sub-bituminous, 
and lignite), depending on the amounts and types of carbon it contains and on the amount 
of heat energy it can produce” (U.S. Energy Information Administration, 2012). Each 
coal consumer must balance costs, including delivery fees, with quality when purchasing 
contracts. This further complicates matters on the river, as consumers are not simply 
buying from the nearest mine, but rather buying the type of coal they need from the mine 
company that offers the best price. This results in non-obvious delivery routes, including 


many instances of coal being delivered to and from locations outside our AOI. 


15 


Emsworth L/D 
Dashields L/D 
Montgomery L/D 
New Cumberland L/D 
Pike Island L/D 
Hannibal L/D 
Allegheny River 
Allegheny L/D 2 
C.W. Bill Young L/D 3 
Allegheny L/D 4 
Allegheny L/D 5 
Monongahela River 
Braddock L/D 
Monongahela L/D 3 
Monongahela L/D 4 
Maxwell L/D 
Grays Landing L/D 
Point Marion L/D 
Morgantown L/D 





Figure 4. The Port of Pittsburgh consists of the Ohio, Monongahela, and Allegheny 
Rivers. This picture illustrates the location of various locks and dams (L/D) 
throughout our AOI, listed in the table to the right. Along the Ohio River 
our AOI is bounded by the Hannibal L/D. Along the Allegheny River our 
AOI is bounded by the Allegheny L/D 5. Along the Monongahela River our 
AOL is bounded by the Morgantown L/D. Source: USACE 2012. 


Locks and dams make river travel possible. Dams maintain the water level, so 
large vessels can transit without running aground. The body of water between two dams 
is known as a pool. Dams create a tiered effect between pools throughout the river 
network. Figure 5 illustrates the sequences of pools on the Monongahela River upstream 


of and including Pittsburgh. 
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Figure 5. | Dams and pools on the Monongahela River. Source: USACE 2012. The failure of the Monongahela L/D 4 results in the 
loss of navigatbility of the river segment or pool between the Monongahela L/D 4 and the Maxwell L/D. Such a failure 
implies the inability to transport coal via river to or from any facilities (i.e., mines or plants) located within that pool. 
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Locks enable vessels to transition from one pool to the next (Figure 6). Passing 
through a lock, known as “locking-through,” can take 30 minutes to several hours, 
depending on queuing, number of barges, and the number of parallel locks available for 


use. 





Figure 6. Aerial view of Emsworth Lock and Dam, Pittsburgh, PA. There are two 
parallel locks (at right) that allow passage between the pools of water 
separated by the dam (at left). Source: USACE 2012. 


The USACE has responsibility for the continued operation of these waterways. In 
total, the USACE operates and maintains 12,000 miles of commercial inland navigation 
channels, including dredging riverbeds and repairing the 600 dams under its 
responsibility (USACE 2012). Because of aging infrastructure throughout the river 
system, scheduled maintenance on locks and dams creates delays of weeks to months. 
These planned repairs are announced to the public far in advance. The USCG also uses 
their website to notify the public of delays, blockages, and expected river conditions in 
nearly real-time. The average age of the 192 inland waterway locks is 50 years old (Gillis 
2009). In the event of catastrophic damage, the USACE relies heavily on established 
contractor support. Pursuant to the National Response Framework (DHS 2008), the 
USACE assists DHS with engineering support and construction supervision, handling 
significant debris removal and demolition when the situation is unmanageable at the local 


or state level. The Monongahela River has two of the oldest locks maintained by the 
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USACE, built in 1905 and 1907. In Calendar Year 2009 together they locked 10,602 
vessels carrying 26,044,941 tons of cargo (USACE 2012). Sudden loss of a dam would 
have cascading affects, damaging infrastructure downstream. 

Disruptions along the waterways range from mere inconveniences, such as minor 
maintenance, to long-term outages resulting from dam failure. This range of possibilities 
carries varying consequences, including increased costs to operate the system. These 
incremental cost increases are clearly undesirable. In September of 2009, Michael 
Hennessy, Vice President of river operations for CONSOL Energy, said, “A catastrophic 
breakdown of one of the Monongahela river’s aging locks, namely the 100-year-old Lock 
3, would bring hundreds of thousands of tons of barge traffic to an abrupt halt with little 
opportunity to quickly or efficiently divert the cargo to other land-based transport modes” 
(Gillis 2009). 

Natural disruptions along the river may result from flooding, freezing, 
infrastructure failure, or large debris (i.e., a sunken vessel). Some delays are scheduled, 
while others are unanticipated and result from seasonality or random happenings. 
Maintenance downtime can last from weeks to months, but auxiliary locks, and small 
temporary locks used to mitigate complete stoppage, alleviate some of the backlog of 
barges. The need for unscheduled maintenance increases as critical components fail from 
years of use. 

Another class of disruption includes deliberate attacks from a malicious agent. 
These types of attacks may include destroying critical infrastructure (e.g., locks, dams, or 
bridges) and are more challenging to prepare for. A May 2012 attempt to attack nearby 
infrastructure using “explosive materials to damage physical property affecting interstate 
commerce,” is a real-world example of such an attempt at disruption (Barrett 2012). 

Figure 7 shows that delays have increased over time as a result of scheduled and 


nonscheduled maintenance. 
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Figure 7. | Unscheduled lock outages. Source: Smith (Coal Power Magazine), 2007. 


The fragility of this shipping network and the limited resources of the USCG and 
USACE make the Port of Pittsburgh vulnerable to long-term disruption. Applying game 
theory system interdiction techniques to this problem will pinpoint CI/KR components 
whose loss has the biggest impact on system function. This proactive approach will 
identify vulnerabilities in the context of a malicious adversary and will aid decision 


makers as they prepare for worst-case scenarios and defend critical lines of commerce. 
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IV. THE OPERATOR’S MODEL 


The transport of coal through Pittsburgh is driven by contracts between suppliers 
and consumers. These shipping contracts are satisfied through the movement of coal by 
barge, train, and truck from mines to customer destinations within our AOI. These 
contracts link the delivery of a specific commodity from a specific supplier to a specific 
consumer at a specific time. 

We model a multi-commodity transshipment system in which each commodity 
(i.e., each individual contract) can travel along multiple modes of transport, each having 
different capacity and cost. We consider two types of coal (bituminous and lignite) and 
keep track of contracted shipments by destination (customer) and week of delivery. Thus, 
a “commodity” in this model is in fact a combination of (coal type, source, destination, 
and delivery week). 

We partition the set of nodes into two types. “Terminal” nodes are the origins and 
destinations of flow, they can store commodity inventory, and they are not associated 
with any particular mode of transportation. A terminal is a place where coal is supplied, 
consumed, and/or stored or a place where coal is transferred on or off one of the three 
modes of transport. In contrast, each “transshipment” node is associated with a specific 
mode of transportation, and it cannot originate, terminate, or store commodities. 

Accordingly, there are two types of arcs. “Transfer arcs” move commodity 
between terminal nodes and transshipment nodes. “Transshipment arcs” move 
commodity between transshipment nodes. Commodities can move from one mode of 
transportation to another only by transiting through a terminal node. Additionally, modes 
of shipment have finite capacities with varying costs. Cranes, conveyors, excavators, and 
other innovative means accomplish loading and offloading. These arcs have both a 
capacity (i.e., equipment limitations) and cost (loading cost of $0.15 per ton and 
offloading cost of $0.30 per ton). The drawing in Figure 8 illustrates the relationship 
terminal nodes have with modal (i.e., river, rail, or road) transshipment nodes, enabled by 


intermodal transfer arcs. 
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Figure 8. | Transfer arcs between a terminal node and transshipment nodes for each of 
the three modes of transportation considered in this thesis. Capacities on 
transfer arcs may limit the ability to move coal to or from an individual 
mode of transportation. 





We consider the movement of coal over a time horizon ranging from one to 
several weeks. The only interaction between time periods is through commodity 
inventory that is carried from one time period to the next at a terminal node. 

To understand how the system functions in the presence of disruptions, we must 
first understand how the system functions under normal operations. We begin with the 


assumption that all coal is transported via river during standard operating conditions. 
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A. MODEL FORMULATION 


We present the formal mathematical model of system operations, in Naval 


Postgraduate School standard form (amended 27 July 2012). 


Index Sets [~cardinality]: 





neN nodes [~100] 

reRCN transshipment nodes (alias /, /) 

déeDCN terminal nodes (alias 0,s) RA D=@; RUD=N 
meM modes of transport; M={river, rail, road, transfer} 


mx € MX = M \'transfer' 

{m,i,j}e¢€ACMxNxN directed arcs (from node i to node j using mode m) [~500] 

{m,i, j} EU |{m,i, j} e AV {m, j,i} © A undirected arcs [~250] 

wew time periods (alias wd) [weeks, ~50] 

{w,wd}e¢ FORE _LOG time periods w during which shipments can be made for 
contracts due in time period wd ( w < wd )[~50] 

{m,i, j,w}¢ ARC _I if arc {m,i,j} is damaged, it is still inoperable during time 
period w [~500] 

cEeC cargo type [~2] 

{c,d,wd}<=COM contract commodity [~1,000] 


Input Data [units]: 





CONTACT, 6 4 wa amount of cargo type c originating at node o contracted for 


delivery to node d during time period wd [tons] 


COSt yj j cost per unit flow for using arc {m,i, j} ¢ A [cost] 

CPEN, » dowd per-unit penalty for failing to deliver contract volume [cost/ton] 
hcost, holding cost for inventory at terminal s [cost/ton] 

inv _cap, inventory capacity at terminal s [tons] 


23 


spen, .. 


ATTACK ji, 


ni, 
CAP ni, j 


UCAaP , j, j 


Computed Data: 


demand . 4 wa 


per-unit demand shortfall penalty at node s of cargo type c 
[cost/ton] 

binary indicator as to whether arc {m,i, j} ¢ A 1s damaged; 

= 1 if arc {m,i, j}is damaged, = 0 otherwise [binary] 

per unit flow penalty for using arc {m,i, j} <¢ A if damaged [cost] 
directed capacity of arc {m,i, j} <¢ A [tons] 

undirected (shared) capacity of arcs {m,i, j}¢ A and {m, j,i}Je A, 


i<j [tons] 


demand for cargo type c at node d at during time period wd [tons] 


demand , dvd = > contract, . aot 
oeN 


Non-negative Decision Variables [units]: 


F 


o,w,c,d,wd 


m,i, j,w,c.d,wd 


R 


s,w,c,d,wd 


flow from mine o during time period w of contract cargo {c,d,wd} 
[tons] 

flow along arc {m,i, j}< A during time period w of contract cargo 
{c,d,wd} [tons] 

inventory at node s at start of time period w of contract cargo 
{c,d,wd} [tons] 

transfer node s shortage at start of time period w of contract cargo 
{c,d,wd} [tons] 

transfer node s excess at start of time period w of contract cargo 


{c,d,wd} [tons] 
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Formulation 1: Defender Model (D) 
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{c,d,wd}—=COM,, 
{w,wd}<eFORE _LOG 
+ by CPeNn, «dw (contract, 6 4 wa ~ 8 Pou) 
oeD, {w,wd}eFORE _ LOG 
{c,d,wd}=COM 
+ by RCOST IN i. sya 
seD, 
{c,d,wd}—=COM, 
{w,wd}e FORE _LOG 
+ ¥ SDEN aA, ip oy + oy spen, aR, y oa.aw (SO) 
seD, seD, 
{c,d,wd}—=COM, {c,d,wd}—=COM, 
{w,wd}eFORE _ LOG {w,wd}eFORE _ LOG 
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{c,d,wd} «COM (S2) 
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{c,d,wd} <= COM (S3) 
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{w,wd}eFORE _ LOG 
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ee? w,c,d,wd Haney) er coe Vim,i, j} €U,Jwew (S5) 
IN, w.c.d,wd = CAP _inv, VseD,wew (S6) 
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The objective (SO) measures the total transit, transfer and inventory holding cost, 
plus any penalties for shortfalls or contract violations. The “attack” terms will be 
discussed in a following section, but here merely represent arcs whose costs have risen so 
dramatically they will not be used. Each constraint (S1) ensures for some contract that 
total flows from the source mine meet the contract amount. Note that in case of 
anticipated disruptions, flows may leave the mine earlier than the delivery contract week 
to be stored in intermediate inventory somewhere and conveyed to the customer later. 
Each constraint (S2) accounts for balance of flow at some transfer node at the start of a 
planning period for some commodity. Each constraint (S3) accounts for inter-modal 
transfers at some terminal node of come commodity, including inventory, shortfall, 
supply, and demand. Constraints (S4) and (S5) enforce directed and undirected capacity 
on arcs, respectively. Each constraint (S6) limits inventory held at some terminal at the 
start of some planning period. 

This model finds the minimum cost means of delivering the contracted amount 
from each source to each destination, along one of several modes of transport, each 
having their own costs and capacities. An interdiction on an arc increases its usage cost, 
so if there is a disruption in one system (e.g., river), then the model looks for a low-cost 
alternative route (e.g., river, rail, or road). There is a penalty (cpencoa) for violating 
delivery of contracted amounts (e.g., by satisfying a customer from an alternative 
supplier), but in general this penalty is less than the penalty for incurring a customer 
shortfall (spensc). 

The model has the flexibility to move and store coal in advance of its contract 
delivery date. This is advantageous when planning for scheduled maintenance or when 
buffering inventories to reduce the impact of unplanned disruptions. This functionality is 
controlled by the FORE_LOG mechanism in the formulation, which maintains an aspect 
of realism in delivery planning by limiting the model’s forecasting ability. A reasonable 
use of this mechanism might be to allow the model to plan ahead and move coal up to 


four weeks in advance. This prevents the model from transporting all coal in the first 
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week of operations, limited only by infrastructure capacity. This unrestricted movement 
of coal is inconsistent with industry practice, which is more similar to a Just-In-Time 
system. 

This thesis only uses a single time period of one week, a restriction that could be 
used to considerably simplify the model exposition. However, we have chosen to display 
the full model for a multi-time period planning horizon and show how shipments can 
preposition contracts and how demand can be satisfied before anticipated future losses of 


system components. 
B. BUILDING THE NETWORK 


In this section, we describe how we use information about the real system to 
develop data that we can use as input to the Operator Model formulation. The goal is to 
have our mathematical model mimic real-world behavior. 

Dams separate rivers into pools, enabling navigability. Locks allow movement 
from one pool to the next. Figure 9 illustrates this concept of segmenting rivers and 


provides a numbering system throughout the Port of Pittsburgh. 


Dams separate the river into pools. 


Locks allow movement between pools. 





Figure 9. Dams segment the river into pools, which are numbered. Locks enable 
transit between pools. The Hannibal L/D and the Pike Island L/D on the 
Ohio River form Pool 10. 
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Our numbering scheme for locations is as follows. Starting at the downstream end 
of the AOI, we assign each river pool an increasing multiple of 10. We assign each river 
terminal associated with that pool a number equal to the pool plus a value 1-9 
representing its relative geographic location within the pool. The result is that the 
locations are naturally sorted (from downstream to upstream) according to their 
identification numbers (low to high). The simplified river network in Figure 10 illustrates 
the use of the pool identification numbering convention and the relationship terminals 


share in a pool. 


Simplified river system 





Figure 10. Simplified river system showing a total of 44 terminals connected to 18 
pools. Terminal 16 is located in Pool 10. 


Terminals also connect to the rail and road network in a similar manner. Figure 11 
shows the rail and road networks, including illustrative bridges that cross rivers and 


connect land masses. 
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Simplified river, rail, & road system 





Figure 11. Simplified river, rail, and road system, with bridges connecting landmasses 
by crossing over rivers. 


This overall network has several different kinds of arcs that play specific roles in 


our analysis. 


e Transfer arcs from terminal nodes to and from transshipment nodes represent the 
ability to move commodity on or off a particular mode of transport. The capacities 
of these arcs are constrained by the physical equipment and/or processes available 
for loading and unloading coal. An interdiction on a transfer arc means that the 


terminal cannot send or receive coal from that transport mode. 


e Arcs connecting pools represent the ability to move commodity through the locks 
separating the pools. An interdiction on such an arc results in the inability to 


move commodity between pools. 


29 


e Arcs representing commodity movement within a pool. In order to represent an 
attack on a dam that could result in the loss of an entire river pool, we “split” each 
pool node into an “inbound” and “outbound” node and connect these with a single 
directed arc (see Ahuja, Magnanti and Orlin 1993, p. 41-42 for a discussion of 
this “node splitting” technique). An interdiction on this single arc results in the 


inability to move commodity within the pool. 


e Arcs representing movement on rail or road segments. Bridges, in particular, can 
form bottlenecks that constrain movement on land; interdictions on these arcs 


represent restrictions of such movement. 


Each of the arcs in our network has an associated cost and capacity, which are important 


factors in how the Operator’s Model chooses to route commodity flow. 
C. CAPACITY AND COST 
1 Capacity of Rivers 


For the purposes of our analysis, we assume a river has limitless capacity. Barges 
travel at a speed of roughly 4 miles per hour and are restricted to the geographical 
contours of the river. However, navigating a lock limits throughput. Barges can carry 
1,500 tons of cargo. A standard barge tow consists of 12 to 15 barges tied together 
(National Waterways Foundation 2008). A standard barge tow can take from two to eight 
hours to pass through a lock (Waterways Council 2011). Assuming 24 hours of operation 
per day and 7 days of operation per week, we have a capacity of (/5 barges per barge 
tow x 1,500 tons per barge x 8 barge-tows per hour x 24 hours per day x 7 days per 
week =) 30.24 million tons per week. 

The costs of transporting commodities by river are less than other modes of travel. 
The Port of Pittsburgh Commission states the average cost per ton-mile by barge is 
between $0.005 and $0.01 (PPC 2012b). For the purpose of this analysis, we will use a 
cost per ton-mile of $0.008. 
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2. Capacity of Rail (Including a Discussion on Bridges) 


A jumbo hopper rail car can carry approximately 100 tons of cargo. Coal train 
length, measured by the number of railcars coupled together, is limited by the number of 
engines employed, steepness of track grades, Department of Transportation (DOT) 
regulations (DOT 2012), and other mechanically limiting factors such as air-brake 
restrictions. A typical coal train can safely pull 150 fully loaded coal hoppers. Each coal 
train then carries (100 tons of cargo per hopper x 150 fully loaded hoppers per train =) 
15,000 tons. 

Like locks on a river, bridges can create bottlenecks for rail traffic, as only a finite 
number of trains can traverse the bridge during a given time epoch. A 2006 survey 
established there are 446 bridges within the Pittsburgh city limits, the most of any city in 
the world, surpassing Venice, Italy (Regan 2006). A train of 150 cars is (46 feet long per 
hopper car x 150 hopper cars =) 7,000 feet long (Environmodal 2012). At a safe speed of 
15 miles per hour (Norfolk Southern Railroad Company 2012), including stops, (/5 mph / 
7,000ft =) 11.3 trains per hour could pass a given point. This speed includes loading, 
offloading, stops, and operational time. Operating 24 hours per day and 7 days per week 
results in a maximum capacity of (/1.3 trains per hour x 24 hours per day x 7 days per 
week =) 1,898 trains, with a total cargo capacity of (/,898 trains x 15,000 tons per train 
=) 28.5 million tons per week. 

Additional capacity limitations include the number of rail lines and the 
availability of rail cars and engines. Trains are constrained to tracks. While this might 
seem restrictive, it does provide more route diversity than barges constrained to rivers. 


The average cost to move coal by rail car is $0.05 per ton-mile (PPC 2012b). 


3. Capacity of Roads (Including Bridges) 


A conservative estimate of the maximum capacity of a coal-carrying truck is 
25 tons (The Energy Library 2009). Trucks provide the most flexibility of any mode of 
transportation. Trucks are typically employed only for short movements as the costs to 


move such small volume quickly erase potential profits. 
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Again, bridges create bottlenecks and limit total throughput. There are a total of 
75 road bridges within our AOI that cross the Ohio, Monongahela, and Allegheny rivers. 
The average weekly traffic over some of Pittsburgh’s busiest bridges in 2009 was around 
20,000 vehicles per day (less than 10% or 2,000 were trucks) (City-Data 2012). 
Assuming anything greater than a 50% increase in traffic would halt movement, we take 
30,000 (20,000 + .50 x 20,000) as the maximum capacity of any bridge during a day. 
This represents a 500% increase in truck traffic, which would be significant, but 
necessary for emergency rerouting. The 10,000 trucks equates to (10,000 vehicles per day 
x 7 days per week x 25 tons per truck =) 1.75 million tons of coal per week by road. 

Transporting coal by trucks on roads is the most expensive option at $0.10 per 


ton-mile (PPC 2012b). 


4. Capacity of Terminals 


Terminals are locations with the capacity to load and/or offload cargo or to 
transfer commodities from one mode of shipment to another. Each terminal is unique and 
may possess different kinds of heavy lifting equipment (e.g., conveyors, electric whirler 
cranes, hoists, or clamshell buckets). The availability of commodity-transferring assets 
presents capacity limitations at each terminal. Transfer capacity may vary by mode of 
transport. 

Additionally, some terminals are not accessible by every mode of transportation. 
For instance, some terminals do not have rail lines or have limited road access. 

The speed of commodity transfers also presents capacity limitations. Offloading 
and loading does not happen instantaneously. Large shipments of coal, up to 15 barges 
each carrying 1,500 tons of coal, take time and manpower to move. Each piece of 
commodity-moving equipment operates at a different speed and some terminals are not 
outfitted with the newest technology or the fastest equipment. 

For the purposes of our analysis, we assume the average cost for loading coal onto 
barges, rail cars, or trucks is $0.15 per ton. Because offloading is more labor intensive 


and costs are higher, we assume the cost of this is $0.30 per ton. 
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D. INVENTORY 


In our Operator’s Model, any terminal node can carry inventory to facilitate low- 
cost transport of coal. In practice, however, power plants typically carry a certain amount 
of inventory, on average 45 days, in order to compensate for interruptions in supply such 
as miner’s strikes and/or holidays, adverse weather or transportation problems (Phillips 


2008). Methods of storage are closed silos and open storage. 
E. REPAIR TIMES 


When a piece of infrastructure is damaged, whether by deliberate or non- 
deliberate means, it is not necessarily lost forever. Repairs to river, rail, or road 
infrastructure take time, but are often joint efforts by government and non-government 
agencies. For the purposes of our analysis, repair times for critical infrastructure are 
measured in weeks. We simplistically assume that transfer equipment (i.e., conveyors or 
cranes) take two weeks to repair. Locks are uniquely constructed and repairs are labor- 
intensive tasks that we assume take four weeks each. Dams are the most time-consuming 
repairs, assumed here to take 13 weeks each. Roads and rail lines are typically repaired 
within one week; therefore we consider their repair times to be negligible, as these repairs 


can be accomplished within a single model time period. 
F. TRAFFIC DEMAND BY ORIGIN-DESTINATION 


The U.S. Army Corps of Engineers (USACE) maintains lock throughput data for 
the entire inland waterways. Our study considers 2009 data for the Port of Pittsburgh. 


This data contains the following noteworthy fields of information: 


e Commodity Name, 
e Origin Name, 

e Destination Name, 
e Delivery Date, and 
e Tons. 


Working with the USCG, USACE provided a comma-separated-value (csv) file 
with over 20,000 lines of data representing individual movements of coal. Given this 
extremely valuable source of information, we face two challenges. First, we need to 


understand whether these historical coal flows have structure that could perhaps provide 
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insight into the most critical parts of the river. Second, we need to get the data in a form 
that can be used by our mathematical AD model, which we implemented in the 
Generalized Algebraic Modeling System (GAMS) (GAMS 2012). To address these 
challenges, we use Visual Basic for Applications (VBA) in Microsoft Excel (Microsoft 
Corporation 2012) to manipulate, sort, filter, and aggregate the data. This section 


describes this data development and its insights. 


1. Data Preprocessing 


Our raw data includes numerous commodities, such as grain, gravel, and 
petroleum-based products, but the data also includes lignite coal and bituminous (a.k.a. 
coke) coal. Coal is of sole importance to this study. Because we focus exclusively on coal 
movement, we filter out non-coal goods, leaving around 15,000 lines of data. 

Next, we transform the data into a form that follows a standard naming 
convention and adheres to the requirements for use in GAMS (e.g., use of underscore 
characters instead of spaces). We reduce commodity names to simply COAL_A or 
COAL_B. We assign each origin and destination location a unique identification number 
as a programing simplification and in order not to reveal sensitive data that exposes 
specific customer relationships. Additionally, we associate each location with a specific 
river pool so we can easily observe relationships along the waterways. Finally, we 
associate each delivery date with a week of year (1 through 52). The result is a new 


augmented table with the following fields: 


New Commodity Name, 
New Origin Name, 
Origin ID, 

Origin Pool, 

New Destination Name, 
Destination ID, 
Destination Pool, and 
Week Number. 


Table 1 shows a partial list (Monongahela River terminals only) of our terminal 
names with their identification numbers. Because our river network connects to a much 


larger network of rivers via the Ohio River, we adopt the convention of a notional node 
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outside of our region. This single ‘super’ terminal, known as the OHIO_1, represents an 


aggregate of all source and destination terminals outside of our AOI. 





TERMINAL NODE NODE ID # 
OHIO_1 1 
MON_1 111 
MON_2 112 
MON_3 113 
MON_4 114 
MON_5 115 
MON_6 121 
MON_7 122 
MON_8 123 
MON_9 124 
MON_10 125 
MON_11 131 
MON_12 132 
MON_13 141 
MON_14 142 
MON_15 143 
MON_16 151 
MON_17 152 
MON_18 161 
MON_19 162 
MON_20 163 
MON_21 164 
MON_22 171 








Table 1. | Terminal nodes with node identification numbers. Our Ohio Super terminal 
is OHIO_1 and its node identification number is 1. The last terminal on the 
Monongahela is MON_22 and its node identification number is 171. 


Additional nodes enable the model to properly replicate real-world functionality, 
such as an offloading point along a river. These include river nodes, rail nodes, and road 
nodes. There are many of these nodes in our model; several examples of these nodes are 


listed in Table 2. 
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Intermodal Nodes | Node ID # 





Table 2. River, rail, and road nodes facilitate intermodal transfers. The 
ROAD _OHIO_1 node is the road node associated with the OHIO_1 

terminal and its node identification number is 342. 
Arcs connecting these nodes are limited by capacities related to their mode of transport 


(i.e., river, rail, or road) and loading and offloading equipment (cranes, conveyors) at 


terminals 


2s Data Aggregation 


Observing coal throughput is a first step in understanding key infrastructure. 
Trying to understand thousands of pieces of data independently is a daunting task, so we 
build an origin-destination matrix to group similar data and expose delivery patterns. The 
matrix in Figure 12 illustrates this aggregation of coal data. The row and column headers 
are our terminal nodes, listed by their identification numbers. Lines in the matrix 
represent locks and dams. Flows are grey-scale coded to highlight supply and demand 
fluctuations, with light grey representing low, dark grey representing medium and black 


representing high tonnage. 
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Figure 12. Origin-Destination Matrix for coal transport. The sparsity of this matrix indicates that in practice there are only a 
relatively small number of contracted supplier-customer relationships. 
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From this matrix we develop Table 3 that shows a ranking of the most significant 
shippers and receivers of coal for an entire year. Clearly, coal moving to and from 


OHIO_1 is significant. But, flow along the Monongahela is also very substantial. 


1 4,788,373 OHIO_1 25.27% 1 6,627,767 MON_15 
2 4,081,834 MON_14 21.54% 2 4,356,684 OHIO_1 
3 2,694,070 MON_4 14.22% 3 3,458,572 MON_13 
4 1,980,786 MON_19 10.45% 4 1,704,103 OHIO_17 
5 1,079,146 ALLY_1 5.69% 5 1,429,133 MON_20 
749,909 MON_1 3.96% 358,129 OHIO_11 
744,456 MON_11 3.93% 184,139 MON_12 
473,327 MON_2 2.50% 181,888 MON_21 
469,791 OHIO_14 2.48% 153,200 MON_17 
429,211 OHIO_19 2.26% 142,763 MON_18 
376,478 MON_9 1.99% 114,821 MON_10 
356,279 MON_12 1.88% 101,198 MON_6 
236,322 OHIO_16 1.25% 61,871 OHIO_18 
216,920 OHIO_5 1.14% 35,529 ALLY_3 
95,186 OHIO_15 0.50% 19,585 MON_5 
49,062 MON_7 0.26% 11,755 MON_8 
42,805 MON_23 0.23% 8,083 MON_23 
39,914 OHIO_8 0.21% 1,570 MON 3 
34,015 MON_6 0.18% 
10,038 OHIO_3 0.05% 
1,768 ALLY_3 0.01% 
1,100 OHIO_17 0.01% 





Table 3. Top receiving and shipping terminals in the entire Port of Pittsburgh. The 
OHIO_1 terminal is essentially an exit portal from our AOI. Note the large 
amounts of coal entering and leaving the system at this terminal. 


Figure 13 illustrates how seasonal climate changes affect coal demand in the 
Pittsburgh region. Cold winter months (December, January, February, and March) and 
hot summer months (July and August) increase heating and cooling needs. The lowest 
consumption occurs in October (~7.6 million tons), compared to the highest consumption 
in February (~12.6 million tons). February has shorter days, approximately 10.5 hours of 
sunlight, meaning more electricity is used for lighting, compared to 12 hours of sunlight 
in October. Colder February temperatures, on average 35 degrees Fahrenheit, result in 
increased heating costs compared to mild October temperatures of 55 degrees Fahrenheit 


(The Weather Channel 2012). These seasonal factors influence a nearly 66% increase in 
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coal consumption. In order to observe model behavior under a more stressful coal 
delivery scenario, we consider normal operation during one of these peak periods, 


specifically week 1. 
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Figure 13. Coal flows through the Pittsburgh AOI by four-week “month.” Seasonal 
fluctuations are mostly consistent across pools, with the first eight weeks of 
the calendar year showing the largest overall flows. 

As one would expect, locks and dams conveying large volumes of coal are more 
significant to the system than those locks and dams supporting little or no coal 
movement. Because dams maintain navigability along the river, it is vital that we 
understand which dams support the most coal traffic. Figure 14 shows coal throughput, 
measured in tons, for each pool in the Port of Pittsburgh. It is clear that pools 40, 50, 60, 
and 110 constitute a top-tier. The next significant group consists of pools 0, 10, 20, 30, 
120, 130, 140 and possibly 150 and 160. Finally, it seems that pools 70, 80, 90, 100, and 
170 are less critical to the movement of the majority of coal through our AOI. This 
cursory analysis helps to develop our intuition regarding coal traffic and provides a 


baseline understanding of standard coal operations in the Pittsburgh region. 
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Figure 14. Coal flow through each pool in the Pittsburgh area. Pools 0 through 60 
constitute the Ohio River. Pools 70 through 100 constitute the Allegheny 
River. Pools 110 through 170 constitute the Monongahela River. 


The bar chart in Figure 14 illustrates the disproportionately small volume of coal 
flowing through the Allegheny River (Pools 70, 80, 90, and 100). This chart also shows 
the large amount of coal flowing into, out of, and remaining on the Monongahela River 
(Pools 110 through 170). For these reasons, we focus our attention on the Monongahela 


River. 
G. BUILDING INPUT FILES FOR GAMS 


Constructing usable input files for GAMS requires the thoughtful collection and 
aggregation of various data fields. Figure 15 displays a portion of the arc_data.csv file, 
which lists all arcs by mode, source, and destination. The data file also includes directed 
and undirected capacities (cap and ucap), cost per ton-mile to traverse the arc (cost), a 
penalty value for attempting to traverse the arc if the arc is attacked (q), and a repair time 
(recon_time) for each arc. This file is an example of the types of files necessary for 


system interdiction modeling with GAMS. Such files consist of thousands of lines of 
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information, which are impractical to manually generate. The use of explicit rules and 
programming logic applied via VBA coding enables quick, accurate computation and 


provides flexibility for later changes. 


source 
RAIL_MON_3 
RAIL_MON_3 
RAIL_MON_3 
RAIL_MON_3 
ROAD MON 3 
ROAD _MON_3 
ROAD_MON 3 
ROAD_MON_3 
ROAD_MON_3 
RIVER_MON_3 


wWwwnn OU fF Wn 


c 
destination 
RAIL_MON_BRIDGE_1 
RAIL_MON_BRIDGE_2 
RAIL_MON_BRIDGE_3 
RAIL_MON_BRIDGE_4 
ROAD_MON_2 
ROAD_MON 4 
ROAD_MON_5 
ROAD_MON_6 
ROAD_MON_7 
POOL_120 IN 


G 

ucap 
28500000 
28500000 
28500000 
28500000 
1750000 
1750000 
1750000 
1750000 
1750000 
30200000 


H 
recon_time 


1 
1 
1 
1 
1 
1 
1 
al 
1 
2 





Figure 15. The arc_data.csv file showcases various fields necessary for system 
interdiction modeling. Generating such files manually is impractical. The 
RAIL arc originating from RAIL MON 3 and_= destined for 
RAIL_MON_BRIDGE_1 has a directed capacity (cap) and undirected 
capacity (ucap) of 28,500,000, a transportation cost of $1.35 per ton-mile, 
an interdiction penalty (g) of 10,000 and a repair time (recon_time) of 1 
week. 


Time developing data is time well spent, even if the upfront cost to evaluate raw 
data may seem high. Our raw data contains over 20,000 lines of information with over 25 
unique fields. However, the reward for properly assessing the data and digesting the story 
the numbers tell is worth the investment. This initial analysis enables quick 
understanding of coal movement through the AOI, gives us some cursory intuition 
regarding the more significant and less significant infrastructure components, and 


provides useful input for GAMS to quickly solve large, complex problems. 
H. ASSESSING BASELINE OPERATIONS: THE MONONGAHELA RIVER 


In the remainder of this thesis, we focus on the flow of coal on the Monongahela 
River. Although only a subset of our entire AOI, it is a region with perhaps the highest 


density of river terminals. Figure 16(Left) identifies this narrowed AOI. 


4] 





Figure 16. Left: The Monongahela River highlighted in blue within the oval. Right: 
Network representation of the Monongahela River. 

To further make the case for the significance of focusing on the Monongahela 
River, the largest coking plant in the U.S., the U.S. Steel Clairton Plant, and the largest 
underground coal mine in the U.S. both reside on this river (Waterways Council 2010). 
Additionally, the river has 24 terminals, eight pools, seven locks and dams, eight rail 
bridges, and 26 road bridges. Although reduced in size, this system has significant 
“mternal” coal flow (i.e., shipments originating from a terminal on the Monongahela 
River and destined for delivery to another terminal on the Monongahela River), as well as 
significant inbound and outbound coal shipments (1.e., coming to or from terminals on the 
Ohio River). Figure 16(Right) illustrates our narrowed focus of the Monongahela River 
network. 

Having developed the necessary input data for the Operator’s Model, we begin 
with an analysis of uninterrupted operations. Considering only one week of operations, 
our model estimates 1,244,879 tons of coal is delivered at a cost of $255,450. All coal is 
transported along the river and transfer costs account for approximately one-third of total 


cost. This requires a minimum of 711 fully loaded barges. 
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These operating costs serve as a baseline for all subsequent analysis. With no 
interdictions the Operator’s Model finds the least costly method of transporting all 
shipments of coal from source to destination. In this case, the mode of RIVER is chosen 
for its low cost per ton-mile rate. This is consistent with the real system, in which all 
commodities move by barge. 

In reality, contracts between suppliers (e.g., mines) and consumers (e.g., 
electricity plants) drive flows from sources to destinations. Table 4 displays contract data 
for the first week of operation on the Monongahela River. Keep in mind that Ohio super 
terminal OHIO_1 represents source and destination activity outside of our narrowed AOI, 


which only includes the Monongahela River. 


CONTRACTS 
SOURCE DESTINATION CARGO TYPE|WEEK [AMOUNT 





Table 4. | Week 1 contracts between mines and plants. The contract between 
MON_15 and OHIO_1 is for cargo type COAL_A, in week 1, for 59,788 
tons. 

To explain in more detail the commodity flows in our model, we will focus on the 
59,788 tons of COAL_A transported from MON_1I5 (Node ID #143) to OHIO_1 (Node 
ID #1). The cartoon depiction in Figure 17 demonstrates movement of coal from the 


MON_1I5 source node to the OHIO_1 destination node. The coal passes through several 
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locks and dams; as the total tonnage is far less than the maximum capacity for a lock 
during a one-week period. Also, note the transfers from MON_15 onto the river and 
ultimately off the river to OHIO_1. The total cost for the delivery of this coal is $27,383, 
which is a function of distance, mode of travel rate (recall, river = $0.008 per ton mile, 
rail = $0.05 per ton mile, road = $0.10 per ton mile), total tonnage, plus loading and 


offloading costs (loading = $0.15 per ton and offloading = $0.30 per ton). 


Destination: 
Terminal 61 
Demand: 
59,788 tons 
Cost: 
$27,383 


Origin: 
Terminal 143 
Supply: 
59,788 tons 





Figure 17. The flow of coal satisfying the contract from the MON_15 mine at terminal 
node #143 to the OHIO_1 plant at terminal node #1. 


V. ATTACK AND DEFENSE OF RIVER OPERATIONS 


Attacks to river infrastructure in the Port of Pittsburgh pose considerable threat. In 
a single week, the Monongahela River moves more than one million tons of coal at a cost 
of more than $250,000. In this chapter, we identify interdictions that result in worst-case 
disruptions, where “worst-case” means the highest total cost even after the system has 
rebalanced flows. 

We use our Operator’s Model as a starting point. In the event of an attack, the 
Operator’s Model will reroute cargo, finding the cheapest means to satisfy demand in a 
disrupted environment. Undisrupted, the system loads cargo on the river, the cargo 
travels to its destination, and the cargo is offloaded. A disruption to the river unavoidably 
increases traffic on other modes of transport. Because river transport is the cheapest mode 
of travel, moving cargo by rail or road certainly increases cost. This increase in traffic 
may also challenge shipment capacities (e.g., insufficient number of available trucks or 
rail cars) or exceed transfer equipment capacities (e.g., slow conveyors or small cranes); 
further increasing costs if demand is frustrated. 

In our analysis, we first consider the effects of a single attack: analyzing the 
attacker’s most impactful single-attack locations and ranking them accordingly. Then we 
consider multiple simultaneous attacks, where the attacker chooses the most impactful 
locations to for two, three, four, and five simultaneous attacks. We compare these 
outcomes in an operator’s “resiliency curve.” Finally, we consider attacks under varying 
conditions: first, perfectly protected dams and, then, perfectly protected locks and dams. 
These two alternative scenarios provide insight on where and/or how best to employ 


limited resources to improve system resiliency to disruption. 
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A. ATTACKER’S MODEL 


The Attacker’s Model follows directly from the Operator’s Model formulation, by 


replacing the input data ATTACK mi with a decision variable X;j. 





Additional Data 

num_attacks Number of allowable attacks 
Additional Variables 

X mij Disrupt Flow on arc (m,i,j), 


binary indicator as to whether arc (m,i, 7) ¢ A is damaged; 
= 1 if arc (m,i,j) is damaged, 


= 0 otherwise 


Formulation 2: Attacker-Defender Model (AD) 
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X mij = Xmji Vim,i, J)EA (A6) 
> X yi, < 2% num _ attacks (A7) 

(m,i, JJEA 

Xmij €{0, 1} V(m,i, J)EA (A8) 


The objective function (AO) replaces (SO) and now takes a bi-level max-min form, 
with decision variables X,,,; replacing data ATTACK mj. Operating constraints (S1)-(S5) 
apply as before. Constraints (A6) make sure that any attack on a directed arc also affects 


its symmetric arc. Constraints (A7) enforce the attacker’s “budget.” Constraints (A8) 


enforce the binary nature of attacks. 


We implement the Attacker’s Model using the General Algebraic Modeling 
System (GAMS 2012), and solve it with Bender’s Decomposition (see Wood. 2011. for 
details on the use of this technique to solve bi-level network interdiction problems) using 


the CPLEX Optimization Solver (ILOG 2012). 
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B. WORST-CASE SINGLE ATTACK 


We immediately see a 248 percent increase in operating costs, at $559,204. Coal 
is now primarily delivered via rail and transfer costs have increased nearly 40 percent, to 
$100,513. 

The worst single attack is on Pool 60, essentially cutting off all river traffic into 
and out of the Monongahela River. This causes the operator to move the majority of coal 
by rail to its destination. This disruption causes a decrease in river transport, as a large 
amount of cargo is shipped from the Monongahela River to destinations outside of the 
Monongahela River and a large amount of cargo is shipped from origins outside of the 
Monongahela River to destinations on it. 

The top 15 worst-case single attacks are listed in Figure 18. Baseline operations 
are highlighted in green and the most impactful attacks are listed in descending order. 
The first four worst attacks are attacks on dams. These attacks make river transport 
through the associated pool impossible, as the loss of a dam means the loss of pool draft 
and therefore pool navigability. The next most impactful attack occurs at a lock, which 


makes transfer between the two associated pools impossible. 
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COST OF TOP 15 SINGLE BEST ATTACK 


$600,000 


$500,000 


$400,000 


$300,000 — 


$200,000 


$100,000 > 





$o + : ; . . 
BASELINE DAM DAM DAM DAM LOCK LOCK LOCK DAM LOCK LOCK LOCK DAM LOCK LOCK LOCK 
POOL 60 POOL 110 POOL 130 POOL120 = POOLS 130-120 POOLS 110-60 POOLS120-110 POOL140 POOLS 130-140 POOLS 120-130 POOLS 110-120 POOL150 POOLS 140-150 POOLS 150-140 POOLS 140-130 


0 1 2 3 4 5 6 7 8 9 10 11 12 13 4 15 


Figure 18. Baseline operating costs (green) and the cost of the best 15 single attacks to the Monongahela River. Dams are attacked 
first, restricting navigation through pools. Locks are then attacked, restricting the ability to transit between pools. 
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c. MULTIPLE SIMULTANEOUS ATTACKS 


Simultaneous disruptions may occur at multiple, separate locations. These 
simultaneous attacks will necessarily increase costs above the cost of a single worst-case 
disruption. The worst-case scenario for two simultaneous attacks occurs at Pool 60 and 
Pool 130. This attack causes total operating costs to rise to $598,421. The majority of 
coal is then shipped via rail, while some is still moved via river. Interestingly, transfer 
costs decrease from the single attack scenario, as the operator chooses to ship directly 
from source to destination via rail, rather than transferring coal to the river, partly using 
the river, then transferring to rail for the remainder of the trip. With two simultaneous 
attacks, the operator avoids multiple loading and offloading transfers. Table 5 displays 
these statistics. We maintain this standard of conveying operating results throughout the 
remainder of this analysis. As attacks increase, barge use decreases, and rail car and truck 
use increase. Table 5 deconstructs the costs associated with each mode of transport, 
beginning with zero attacks and ending with five simultaneous attacks. Looking at the 
MODAL COST, it becomes apparent that transportation costs rise drastically following 


the initial attack(s). 
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OTAL COST 


711 barges 


536barges| _4,438,75 $35,510 

123,074| _1230railcars| _ 8,463,616 $423,181 
ee en) ee 

po 446,722] $100,513 


121 barges 894,238 $7,154 
8 510,423 
° $598,421 
road | | {id 
359,304] 359,304] $80,843 


8819| Ss barges 53,975 $432 
166,354] 1663 rail cars| 10,593,602 $529,680 
| ee 


320,150] |S _320,150 $72,034 
river [| | 
169,867| 1698 rail cars| 10,603,398 $530,170 
$602,824 
2,964 118 trucks 6,206 $621 
320,150] | —_—320, 150 $72,034 
river [| | 
169,867] 1698 rail cars| 10,603,398 $530,170 
$602,824 
2,964 118 trucks 6,206 $621 
320,150] | S320, 150 $72,034 


Table 5. | Most impactful simultaneous attacks: 0 through 5. For 2 simultaneous 
attacks, 213,250 tons of coal is transported via river and 153,742 tons of 
coal is transported via rail. The cost to operate the system becomes 
$598,421. 





The worst-case scenario for three simultaneous attacks occurs at Pool 60, Pool 
130, and Pool 150. These attacks cause total operating costs to rise to $602,145. The 
majority of coal is shipped via rail, while some is still moved via river and transfer costs 


continue to decrease. 


The worst-case scenario for four simultaneous attacks occurs at Pool 60, Pool 
110, Pool 130, and Pool 150. These attacks cause total operating costs to rise to 
$602,824. The majority of coal is shipped via rail, while some is still moved via river and 


transfer costs continue to decrease. Finally, some coal is moved via road. 
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The worst-case scenario for five simultaneous attacks occurs at Pool 60, Pool 110, 
Pool 120, Pool 130, and Pool 150. These attacks cause total operating costs to plateau at 
$602,824. 


The Operator’s Resiliency Curve in Figure 19 illustrates the increased costs 
associated with attacks 0 through 5. This increased cost to operate the system represents 
the attacker’s “return on investment.” Each attack increases costs; however, after only 


two attacks, the incremental costs become very small. 


$1,000,000 
$900,000 
$800,000 
$700,000 
$600,000 


$500,000 


eee | )perating 


$400,000 
Cost 
$300,000 
$200,000 
$100,000 
SU 


2 3 


Number of Attacks 





Figure 19. Operator’s Resiliency Curve. For an increasing number of attacks on this 
system, there is a diminishing return to the amount of incremental cost that 
can be forced upon the operator. 


Our analysis shows the results of single attacks and multiple attacks significantly 
increase operating costs. Additionally, we note attacks most often occur on dams, to 
eliminate the use of pools, or on locks, to restrict movement between pools. These attacks 
focus on frustrating the flow of coal into and out of our narrowed AOI on the 
Monongahela River. We also notice attacks toward the middle of the Monongahela River, 
disrupting the large amounts of internal coal flows. 

Table 6 breaks out the best attack locations, total cost, and cost increases from 


baseline operations for attacks ranging from zero to five simultaneous attacks. The 
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financial impact of a 2-attack scenario rises to 265 percent increase from baseline 


operations. However, all subsequent combinations of attacks (3-attacks, 4-attacks, and 5- 


attacks) result in less than 2 percent increase in costs. 


Table 6. 


BEST LOCATION OF ATTACK 


Cost COST INCREASE | % COST INCREASE 
ROM BASELINE} FROM BASELINE 


BASELINE $225,aagf 


DAM 


POOL_60_IN POOL_60_OUT 
POOL_110 IN POOL_110 OUT 
POOL_130_IN POOL_130_OUT 
POOL_120_IN POOL_120_ OUT 
POOL_130_OUT POOL_120_IN 
POOL_110 OUT POOL_60_IN 
POOL_120_OUT POOL_110_IN 
POOL_140 IN POOL_140 OUT 
POOL_130_OUT POOL_140_IN 
POOL_120_OUT POOL_130_IN 
POOL_110 OUT POOL_120_IN 
POOL_150_IN POOL_150_ OUT 
POOL_140_OUT POOL_150_IN 
POOL_150_OUT POOL_140_IN 
POOL_140 OUT POOL_130_IN 
POOL_60_IN POOL_60_OUT 
POOL_130_IN POOL_130_OUT 
POOL_60_IN POOL_60_OUT 
POOL_120_ IN POOL_12_OUT 
POOL_60_IN POOL_60_OUT 
POOL_130 OUT POOL_120_IN 
POOL_60_IN POOL_60_OUT 
POOL_110 IN POOL_110 OUT 
POOL_60_IN POOL_60_OUT 
POOL_120 OUT POOL_110_IN 
POOL_60_IN POOL_60_OUT 
POOL_130_IN POOL_130_OUT 
POOL_150_IN POOL_150_ OUT 
POOL_60_IN POOL_60_OUT 
POOL_110_IN POOL_110 OUT 
POOL_130_IN POOL_130_OUT 
POOL_150_IN POOL_150_OUT 
POOL_60_IN POOL_60_OUT 
POOL_110 IN POOL_110 OUT 
POOL_120 OUT POOL_110_IN 
POOL_130_IN POOL_130_OUT 
POOL_150_IN POOL_150_OUT 
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248.04% 
172.12% 


141.57% 
137.90% 
137.70% 
115.89% 


101.87% 


257.36% 


256.70% 


$602,145) $376,696) 


$602,824 $377,375 
$602,824 $377,375 267.39% 


Impact of multiple simultaneous attacks. With 5 simultaneous attacks, Pools 
60, 110, 130, and 150 are attacked, as well as the lock from Pool 120 to 
110. This results in an operating cost of $602,824, which is an increase 
from the baseline of 267.39%. 


Interestingly, the system seems to be fairly resilient following just two attacks. 
This results from a robust rail network and modeling assumptions that make the rail 
network nearly invulnerable. It takes five attacks to force coal onto the most expensive 
form of transportation: trucks on roads. Again, the transfer costs have receded to pre- 
attack costs, as the model no longer finds it advantageous or possible to conduct more 


than one loading and one offloading action per shipment. 
D. ALTERNATIVE SCENARIOS 


To this point our study has considered single and multiple attacks on our network. 
Now, we will consider alternative scenarios involving (1) perfect protection of the dams 
along the river and (2) perfect protection of both locks and dams along the river. This 
perfect protection equates to the invulnerability of those assets (i.e., dams and locks). 

The Operator’s Resiliency Curve (denoted by green triangles) in Figure 20 
illustrates the decreased impact of attacks on our system when pools are perfectly 
protected. Each set of attacks results in a reduced return on investment for the attacker. 
This seems reasonable because the most damaging attacks under normal operating 


conditions are on pools. 


$800,000 


2 3 


Number of Attacks 





Figure 20. Operator’s Resiliency Curve with alternative scenarios of (1) no defense, 
where attacks occur on dams and locks (denoted by red squares), (2) dams 
defended, where attacks occur on locks (denoted by green triangles), and (3) 
dams and locks are defended, where attacks occur on terminals (denoted by 
purple Xs). 
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Next, we consider the scenario of invulnerable locks and dams. Here we consider 
perfectly protected locks and dams, where the river is fully navigable. The best single 
attack occurs on the river transfer arc of a major coal supplier. This attack causes coal to 
be shipped via rail, rather than river. When the attacker makes two simultaneous attacks, 
the attacks occur on the river transfer arc and the rail transfer arc of the same major coal 
supplier. This causes all coal supplied by this mine to be routed on the most expensive 
mode of transportation: road. Finally, with three simultaneous attacks, this major coal 
supplier is completely cut off from the network and is unable to move coal onto the 
network without sending flow along an attacked arc. This incurs an arbitrarily high cost, 
depending on the penalty we set. In practical terms, this action equates to a cost to 
reconstitute the damaged arc to enable the movement of coal. The Operator’s Resiliency 
Curve in Figure 20 (denoted by purple Xs) illustrates this behavior. Initially, the return on 
investment for the first two attack sets is low for the attacker. But, the third attack is 


significantly harmful. 
E. DISCUSSION 


The USCG mission emphasizes the defense of waterway infrastructure, so we 
initially focus on the attack and defense of maritime CI/KR. Not surprisingly, attacks that 
target dams result in worst-case increase to operating cost, even after river operations 
adjust flows to minimize transport costs. If the USCG could perfectly protect dams, we 
observe that, in order to create a worst-case increase in transport cost, an intelligent 
attacker would instead target locks, but the return on investment for mounting attacks is 
reduced. Perfect defense of dams and locks shifts the attention of an attacker to coal 
terminals. In this case, attacking the ability to transfer coal on or off the river at an 
individual terminal results in less overall cost increase, unless an attacker can isolate a 
terminal by interdicting completely its ability to send or receive coal. In this case, the 
resulting “cost” of that isolation can be arbitrarily high, depending on the economic 
consequences to that terminal. This study considers only a simple cost of isolation that is 
the same for all terminals; thus the terminals targeted are the ones that move the largest 


volumes of coal. 
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Vil. CONCLUSION 


The Port of Pittsburgh is a valuable target. With approximately $9 billion in 
annual commerce, the second largest inland port in the U.S. could be significantly 
impacted with just a single attack, causing operating costs to rise nearly 150 percent. 
Adversaries are plotting to disrupt commerce, as evidenced by the recent planned attack 
on a bridge in neighboring Ohio (Barrett 2012). The use of system interdiction techniques 
allows us to identify the most critical infrastructure in our system; in our case dams, 
which support pool navigability. This modeling method allows us to quantify impacts to 
operating costs and consider various alternative scenarios concerning defense tactics and 


schemes. 


The analysis in this thesis represents an important step forward in assessing the 
resilience of the Port of Pittsburgh, and the Inland Marine Transportation System more 


broadly, but there is much more to do. 


First, the focus in this thesis on the Monongahela River should be extended to 
include the entire Three Rivers. We expect broader analysis to confirm the significance of 
the Monongahela River as a critical segment of the Port of Pittsburgh. We also expect an 
expanded study to expose valuable targets along the Ohio River, as this river connects 
our AOI to the larger Marine Transportation System river network. Insights may include 


a clearer understanding of intermodal transportation behavior as travel distances increase. 


Second, it will be important to conduct analysis for horizons longer than a single 
week. In practice, planning for coal movements occurs over weeks and months, and the 
repair times for different system components (e.g., dams, locks, transfer terminals, and 
bridges) could yield different implications for what is most critical. For example, if dams 
have the longest repair times, then their loss naturally has a bigger impact on the long- 


term system operation. 


Third, just as different system components can have significantly different repair 
times, it is reasonable to expect that attacks on these components might require a 


different level of effort. Following the example in Salmeron et al. (2011), it might be 


ay, 


reasonable that the attacker’s “budget” might be measured in terms of personnel rather 
than attacks, with each component requiring a different number of individuals for attack 


SUCCESS. 


Fourth, because the Attacker-Defender model has provisions to allow the operator 
to move coal in anticipation of an announced disruption to occur in the future, it is 
possible to use this model to assess the impact of scheduled maintenance. Exploring this 


model capability in the context of real operations could prove insightful. 


Finally, the analysis in this thesis has taken a limited view of “defensive 
investment,” but the model and technique can be extended to consider a comprehensive 
Defender-Attacker-Defender formulation in which one considers a list of possible 
investment options, ranging from hardening to redundancy to capacity expansion, each 
with its own cost. Then given a fixed limited investment, the DAD model will identify 
the combination(s) of investment that yield the most resilient system. Moreover, it then 
becomes possible to consider how different levels of investment lead to improved 
resilience. Identifying such defensive “return on investment” tradeoffs will be an 
important avenue for future work, particularly in an environment of diminished fiscal 


budgets. 


58 


LIST OF REFERENCES 


Ahuja, R., Magnanti, T. Orlin, J., 1993, Network Flows: Theory, Algorithms, and 
Applications, Prentice Hall, Saddle Ridge, N.J. 


Alderson, D.L., Brown, G.G., Carlyle, W.M., and Wood, R.K., 2011, “Solving Defender- 
Attacker-Defender Models for Infrastructure Defense,” in Operations Research, 
Computing, and Homeland Defense, R.K. Wood and R.F. Dell, editors, 
INFORMS, Hanover, MD, pp. 28-49. 


ASME Innovative Technologies Institute, 2011, RAMCAP framework 2.0 (2006) and 
RAMCAP plus (2011). Retrieved from ASME website: www.asme- 
iti.org/RAMCAP (last accessed on March 2012). 


Babick, John P., 2009, “Tri-Level Optimization of Critical Infrastructure Resilience,” 
M.S. Thesis in Operations Research, Naval Postgraduate School, Monterey, CA, 
USA. September 2009. 


Barrett, Devlin, 2012, “Five Charged in Plan to Bomb Ohio Bridge,” Wall Street Journal. 
Retrieved from Wall Street Journal website: 
http://online.wsj.com/article/SB 1000142405270230405030457737785 161202497 
4. html (last accessed on June 2012). 


Bedford, T., and Cooke, R.,2001, Probabilistic Risk Analysis: Foundations and Methods. 
Cambridge: Cambridge University Press. 


Bencomo, Luis A., 2009, “Modeling the Effects of a Transportation Security Incident on 
the Commercial Transportation System,” M.S. Thesis in Operations Research, 
Naval Postgraduate School, Monterey, CA, USA. September 2009. 


Brown, G., Carlyle, M., Salmeron, J., & Wood, K., 2005, Analyzing the vulnerability of 
critical infrastructure to attack and planning defenses, INFORMS (2005). 


Brown, G., Carlyle, M., Salmeron, J., & Wood, K., 2006, Defending critical 
infrastructure, Interfaces, 36(6), pp. 530-544. 


Brown, G., and Cox, L., 2011, “(How Probabilistic Risk Assessment Can Mislead 
Terrorism Risk Analysts,” Risk Analysis, 31, pp. 196-204. 


City-Data, 2012, Bridge Statistics for Pittsburgh, Pennsylvania (PA) - Condition, Traffic, 
Stress, Structural Evaluation, Project Costs. Retrieved from http://www.city- 
data.com/bridges/bridges-Pittsburgh- 

Pennsylvania1l0.html#2730100003 12#i1xzzly7iJmx4R, (last accessed on June 
2012). 


59 


de la Cruz, Constantino F., 2011, "Defending the Maritime Transport of Cargo for the 
Hawaiian Islands," M.S. Thesis in Operations Research, Naval Postgraduate 
School, Monterey, CA, USA. March 2011. 


Department of Homeland Security (DHS), 2008, National Response Framework. 
Washington, D.C.. Retrieved from: http://www.fema.gov/pdf/emergency/nrf/nrf- 
core.pdf, (last accessed on June 2012). 


Department of Homeland Security (DHS), 2009, National Infrastructure Protection Plan. 
Washington, D.C. 


Department of Homeland Security (DHS), 2010, Risk Steering Committee, DHS Risk 
Lexicon, Retrieved from 
http://www.dhs.gov/xlibrary/assets/dhs_risk_lexicon.pdf, (last accessed on June 
2012). 


Department of Homeland Security (DHS), 2012, Automated Critical Asset Management 
System (ACAMS), Retrieved from DHS website 
http://www.dhs.gov/files/programs/gc_1190729724456.shtm#1, (last accessed on 
June 2012). 


Department of Transportation (DOT), 2012, Federal Railroad Administration, Retrieved 
from DOT website http://www.fra.dot.gov/, (last accessed on June 2012). 


Engel, Ryan S., 2011, “Game theory, Probabilistic Risk, and Randomized Strategy: The 
rulebook revisited with emphasis on Coast Guard Mission Space,” M.S. Thesis in 
Operations Research, Naval Postgraduate School, Monterey, CA, USA. 
December 2011. 


Environmodal, 2012, Smart Transportation, Guide to common railcars, Retrieved from 
http://www.enviromodal.com/files/railcar_guide.pdf, (last accessed on June 
2012). 


GAMS Development Corp, 2012, GAMS v. 23.8.2. Software available from 
http://www.gams.com, (last accessed on June 2012). 


Government Accountability Office (GAO), 2010, “Maritime Security: DHS Progress and 
Challenges in Key Areas of Port Security,” GAO-10-940T, Testimony before the 
Committee on Commerce, Science, and Transportation, U.S. Senate, p. 5. 
Retrieved from http://www.uscg.mil/history/docs/GAO10940t.pdf, (last accessed 
on June 2012). 


Gillis, C., 2009, “Avoiding a heartland heart attack,” in American Shipper International 
Trade and Logistics, Retrieved from: http://www.waterwayscouncil.org/Media 
Center/articles/american_shipper_article.pdf, (last accessed on June 2012). 


60 


Homeland Security Advisory Council (HSAC), 2006, Report of the Critical 
Infrastructure Task Force, U.S. Department of Homeland Security, Washington 
D.C. 


Homeland Security Council (HSC), 2007, National Strategy for Homeland Security. The 
White House, Washington, D.C. Retrieved from 
http://www.hsdl.org/?view&did=479633, (last accessed on June 2012). 


ILOG CPLEX OPTIMIZER, 2012, IBM, Retrieved from http://www- 
01.1ibm.com/software/integration/optimization/cplex-optimizer/, (last accessed on 
June 2012). 


Maritime Transportation Security Act of 2002, 2002, PUBLIC LAW 107-295—NOV. 25, 
2002, Retrieved from http://www.tsa.gov/assets/pdf/MTSA. pdf, (last accessed on June 
2012). 


Microsoft Corporation. 2012. Microsoft Office. Retrieved from 
http://office.microsoft.com/en-us/, (last accessed on June 2012). 


National Research Council (NRC), 2008, Department of Homeland Security bioterrorist 
risk assessment: A call for change. Committee on Methodological Improvements 
to the Department of Homeland Security’s Biological Agent Risk Analysis. 
National Academies Press, Washington, D.C., September 21. 


National Research Council (NRC), 2010, Review of the Department of Homeland 
Security’s approach to risk analysis. Committee to Review the Department of 
Homeland Security’s Approach to Risk Analysis. National Academies Press, 
Washington, D.C. 


National Waterways Foundation, 2008, “Barge It!” Maritime Reporter. Retrieved from 
http://www. nationalwaterwaysfoundation.org/news/JulyMRNWE.pdf , (last 
accessed on June 2012). 


Norfolk Southern Railroad Company, 2012, Railroad Performance Measures, Norfolk 
Southern Weekly Performance Report. Retrieved from 
http://www.railroadpm.org/home/RPM/Performance%20Reports/NS.aspx, (last 
accessed on June 2012). 


Phillips, Julia, 2008, Modeling the U. S. Coal Supply Chain, Colorado School of Mines. 
Retrieved from http://dahl.mines.edu/coalphillips.pdf, (last accessed on June 
2012). 


Pidgeon, Edward D., 2008, “Modeling the Effects of a Transportation Security Incident 
Upon the Marine Transportation System,” M.S. Thesis in Operations Research, 
Naval Postgraduate School, Monterey, CA, USA. June 2008. 


61 


Port of Pittsburgh Commission (PPC), 2009, Port of Pittsburgh Monongahela Fact Sheet. 
Retrieved from: http://www.port.pittsburgh.pa.us/docs/monfactssheets.pdf, (last 
accessed on June 2012). 


Port of Pittsburgh Commission (PPC), 2010, Port of Pittsburgh Commodity Tonnages 
2000 to 2010. Retrieved from: 
http://www. port.pittsburgh.pa.us/docs/pittsburgh_traffic_2010_.pdf, (last accessed 
on June 2012). 


Port of Pittsburgh Commission (PPC), 2012a, Port of Pittsburgh information. Retrieved 
from: www.port.pittsburgh.pa.us/home/, (last accessed on June 2012). 


Port of Pittsburgh Commission (PPC) 2012b, The Port District and Inland Waterway 
System. Retrieved from: 
http://www. port.pittsburgh.pa.us/home/index.asp?page=127, (last accessed on 
June 2012). 


Port of Pittsburgh Commission (PPC), 2012c, Port of Pittsburgh Monongahela Fact 
Sheet. Retrieved from: 
http://www. port.pittsburgh.pa.us/home/index.asp?page=181, (last accessed on 
June 2012). 


Puglio, D.G., 1983, Production, distribution, and reserves of bituminous coal, in 
Majumdar, S.K., and Miller, E.W., eds., Pennsylvania coal—Resources, 
technology, and utilization: Easton, Pa., Pennsylvania Academy of Science 
Publications, p. 25-42. Retrieved from: 
http://pubs.usgs.gov/pp/p1625c/CHAPTER_C/CHAPTER_C.pdf, (last accessed 
on June 2012). 


Regan, Bob, 2006, The Bridges of Pittsburgh, Pittsburgh, PA; The Local History 
Company, 2006. 


Research and Innovative Technology Administration Bureau of Transportation Statistics, 
2002, Commercial Frieght Activity in the United States by Mode of 
Transportation: 2002. Retrieved from 
http://www.bts.gov/publications/freight_in_america/html/table_01.html, (last 
accessed on June 2012). 


Salmeron, J., Alderson, D., and Brown, G., 2011, “Resilience Report: Electric Power 
Infrastructure Supporting Mission Assurance at Vandenberg Air Force Base (U), 
Center for Infrastructure Defense Technical Report NPS-OR-11-008, December. 


99 


62 


Shieh, E., An, B., Tambe, M., Baldwin, C., DiRenzo, J., Maule, B., Meyer, G., 2012, “A 
Deployed Game Theoretic System to Protect the Ports of the United States,” 
Proceedings of the 11th International Conference on Autonomous Agents and 
Multiagent Systems (AAMAS 2012), Conitzer, Winikoff, Padgham, and van der 
Hoek (eds.), 4-8 June 2012, Valencia, Spain. 


Smith, Douglas J., 2007, Coal Plant O&M: River Locks and Barges Are an Aging 
Workforce, Too, in Coal Power Magazine. Retrieved from: 
http://www.coalpowermag.com/plant_design/Coal-Plant-O-and-M-River-Locks- 
and-Barges-Are-an-Aging-Workforce-Too_36.html, (last accessed on June 2012). 


Tambe, M., Shieh, E., & An, B, 2011, Application of game theory to optimizing CG 
resource allocation for PWCS deterrence missions. Coast Guard Research and 
Development Center. 


TEAMCORE, 2011, Research on game theory for security. Retrieved from: 
teamcore.usc.edu/project/security/, (last accessed on March 2012). 


The Energy Library, 2009, Research on modes of coal delivery. Retrieved from: 
http://www.theenergylibrary.com/node/12186, (last accessed on June 2012). 


The Weather Channel, 2012, Monthly Averages for Pittsburgh, PA. Retrieved from: 
http://www.weather.com/outlook/travel/vacationplanner/vacationclimatology/mon 
thly/USPA1290, (last accessed on June 2012). 


US Army Corps of Engineers (USACE), 2012, Research on cost of alternative means of 
transporting commodities. Retrieved from: 
http://www.lrp.usace.army.mil/nav/nav.htm, (last accessed on April 2012). 


US Energy Information Administration, 2012, Types of Coal. Retrieved from: 
http://www.eia.gov/energyexplained/index.cfm?page=coal_home, (last accessed 
on March 2012). 


Waterways Council, Inc., 2010, Ohio River & Tributaries Navigation System Five Year 
Development Plan, USACE. Retrieved from: 
http://www.waterwayscouncil.org/presentations/ORNSARSM/ORS_FY11_FY15 
_Navigation_FYDP_Rev_1.pdf , (last accessed on June 2012). 


Waterways Council, Inc., 2011, Lower Monongahela River Locks & Dams 2, 3 & 4, 
http://www.waterwayscouncil.org/W WSystem/Fact%20Sheets/Mon234.pdf, (last 


accessed on June 2012). 


White, I.C., 1898, The Pittsburgh coal bed, American Geologist, v.21, p. 49-60. 


63 


Wood, R. Kevin, 1993, Deterministic Network Interdiction, Operations Research 
Department, Naval Postgraduate School Monterey, CA 93940, USA, 
Mathematical and Computer Modeling, Vol. 17, No. 2, pp. 1-18, 1993. 


Wood, R.K., 2011, “Bilevel Network Interdiction Models: Formulations and Solutions,” 


in Wiley Encyclopedia of Operations Research and Management Science. DOI: 
10.1002/978047040053 1.eorms0932 


64 


10. 


11. 


INITIAL DISTRIBUTION LIST 


Defense Technical Information Center 
Ft. Belvoir, Virginia 


Dudley Knox Library 
Naval Postgraduate School 
Monterey, California 


Vice Admiral Robert C. Parker 

Commander, Atlantic Area / Commander, Defense Force East 
United States Coast Guard 

Portsmouth, Virginia 


Rear Admiral Roy A. Nash 
Commander, Eighth Coast Guard District 
New Orleans, Louisiana 


Commander Richard Timme 
Commanding Officer, Marine Safety Unit Pittsburgh 
Pittsburgh, Pennsylvania 


Dr. Joseph DiRenzo III 

Chief Operations Analysis Division (LANT-7) 
United States Coast Guard 

Portsmouth, Virginia 


Marine Corps Representative 
Naval Postgraduate School 
Monterey, California 


Director, Training and Education, MCCDC, Code C46 
Quantico, Virginia 


Director, Marine Corps Research Center, MCCDC, Code C40RC 
Quantico, Virginia 


Marine Corps Tactical Systems Support Activity (Attn: Operations Officer) 
Camp Pendleton, California 


Director, Studies and Analysis Division, MCCDC, Code C45 
Quantico, Virginia 


65 


i: 


13. 


14. 


15. 


C-46, TECOM 
Quantico, Virginia 


Professor David L. Alderson 
Naval Postgraduate School 
Monterey, California 


Professor Gerald G. Brown 
Naval Postgraduate School 
Monterey, California 


CDR Harrison Schramm 
Naval Postgraduate School 
Monterey, California 


66 


